Use !bl-ip to lookup reputation and category signals for a public IPv4 address.

Reputation lists may classify IP addresses into categories such as bad-reputation, special-purpose, or informational listings. These signals are produced by external DNSBL providers and may reflect malware-related activity, spam emissions, unusual traffic patterns, or other behaviors observed by the list operators.

A listing does not necessarily mean that the people using the IP address are responsible for any unwanted activity. Systems may be compromised, misconfigured, or temporarily abused by malicious actors. Some listings may also be false positives or artifacts of how signals are processed.

Most IP addresses listed in !bl-ip and !bl are not malicious and should not be blocked. For example, a Spamhaus PBL listing simply indicates that the IP address belongs to a regular user in an eyeball network and is not expected to host a mail-transfer system. Blocking PBL-listed IP addresses at a web-server level may prevent legitimate human users from accessing your services. Similarly, blocking tor-exit IP addresses may prevent legitimate users from bypassing information-restriction policies.

If your IP address is listed by the IPduh ip-rep list, the listing will expire automatically after 24 hours. IPduh processes a very small amount of signals and is not used by any external systems. The ip-rep answers provided here are informational tips that may help system administrators or analysts understand unusual traffic or debug issues.

Usually, you can also use !bl instead of !bl-ip.

Usage:
!bl-ip <ipv4-address>

The following examples are chosen in random from IP addresses that have been listed in major bad reputation lists in the past. The following examples are random and do not imply anything for the system administrators attending the systems that use the IP addresses or the network administrators managing the IP space.

Usage Examples:
!bl 195.178.110.163
!bl 2.57.234.82
!bl 36.0.8.17
!bl 103.99.3.62
!bl 45.58.159.66
!bl 52.24.217.50
!bl 70.39.75.147
!bl 1.19.18.17
!bl-ip 106.14.135.217
!bl-ip 46.101.78.140
!bl-ip 106.14.135.217
!bl-ip 78.153.140.147


See also:
!help !bl
!bl-dns-slow

If a reputation list characterizes your IP address as “malicious,” you should inspect your systems for configuration issues, compromise indicators, or unintended traffic. If you operate a mail server on the listed IP and experience delivery problems, follow the removal procedure (if one exists) for that specific list. Otherwise, removal is usually unnecessary. Clean up your systems, correct any issues, and the listing will clear on its own over time.